Vendor CultLib as a gitlink so Heimdall's source can be sealed

Heimdall took CultLib as file:../CultLib/packages/*, a sibling checkout
outside this repository. Nothing pinned which CultLib a given Heimdall
commit was built against, and a sealed source could not reach it. The
deploy manifest worked around this by cloning CultLib separately to
/srv/build/CultLib with cultlib_commit=5cefa0db hardcoded in shell -- the
pin existed, it just lived in an untyped place where no build could see it.

vendor/CultLib is now a submodule pinned at exactly 5cefa0db, the commit
the manifest already used, so this change is purely structural: the
dependency does not move. Bumping to a current CultLib is a separate
change, and should be, or a failure could not be attributed.

This also uncovered that the build was never reproducible from a clean
checkout. The sibling directory had dist/ present because someone had
built it by hand at some point; a fresh CultLib clone has none, and the
packages' main/types point straight at dist/. Building Heimdall against a
fresh CultLib fails with thirteen TS2307s. The manifest knew -- it runs
npm ci then npm run build for cultcache-ts, cultnet-ts and cultmesh-ts
before touching Heimdall -- but that knowledge lived only in the shell
script. It belongs in the recipe's steps, which is where it goes next.

Verified end to end on a fresh submodule clone: the three CultLib packages
build, pnpm install resolves, tsc exits 0, dist/src/index.js is produced
(the exact path heimdall.service runs), and vitest passes 38 tests in 9
files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "vendor/CultLib"]
+	path = vendor/CultLib
+	url = https://github.com/GameCult/CultLib.git
+	branch = main

package.json

@@ -18,9 +18,9 @@
   "dependencies": {
     "@fastify/cors": "^11.2.0",
     "@msgpack/msgpack": "^3.1.3",
-    "cultcache-ts": "file:../CultLib/packages/cultcache-ts",
+    "cultcache-ts": "file:vendor/CultLib/packages/cultcache-ts",
-    "cultmesh-ts": "file:../CultLib/packages/cultmesh-ts",
+    "cultmesh-ts": "file:vendor/CultLib/packages/cultmesh-ts",
-    "cultnet-ts": "file:../CultLib/packages/cultnet-ts",
+    "cultnet-ts": "file:vendor/CultLib/packages/cultnet-ts",
     "fastify": "^5.8.5",
     "pg": "^8.20.0",
     "zod": "^3.25.76"
@@ -35,8 +35,8 @@
   },
   "pnpm": {
     "overrides": {
-      "cultcache-ts": "file:../CultLib/packages/cultcache-ts",
+      "cultcache-ts": "file:vendor/CultLib/packages/cultcache-ts",
-      "cultnet-ts": "file:../CultLib/packages/cultnet-ts"
+      "cultnet-ts": "file:vendor/CultLib/packages/cultnet-ts"
     }
   }
 }

pnpm-lock.yaml

@@ -5,8 +5,8 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  cultcache-ts: file:../CultLib/packages/cultcache-ts
+  cultcache-ts: file:vendor/CultLib/packages/cultcache-ts
-  cultnet-ts: file:../CultLib/packages/cultnet-ts
+  cultnet-ts: file:vendor/CultLib/packages/cultnet-ts
 
 importers:
 
@@ -19,14 +19,14 @@ importers:
         specifier: ^3.1.3
         version: 3.1.3
       cultcache-ts:
-        specifier: file:../CultLib/packages/cultcache-ts
+        specifier: file:vendor/CultLib/packages/cultcache-ts
-        version: file:../CultLib/packages/cultcache-ts
+        version: file:vendor/CultLib/packages/cultcache-ts
       cultmesh-ts:
-        specifier: file:../CultLib/packages/cultmesh-ts
+        specifier: file:vendor/CultLib/packages/cultmesh-ts
-        version: file:../CultLib/packages/cultmesh-ts
+        version: file:vendor/CultLib/packages/cultmesh-ts
       cultnet-ts:
-        specifier: file:../CultLib/packages/cultnet-ts
+        specifier: file:vendor/CultLib/packages/cultnet-ts
-        version: file:../CultLib/packages/cultnet-ts
+        version: file:vendor/CultLib/packages/cultnet-ts
       fastify:
         specifier: ^5.8.5
         version: 5.8.5
@@ -462,16 +462,16 @@ packages:
     resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
     engines: {node: '>=18'}
 
-  cultcache-ts@file:../CultLib/packages/cultcache-ts:
+  cultcache-ts@file:vendor/CultLib/packages/cultcache-ts:
-    resolution: {directory: ../CultLib/packages/cultcache-ts, type: directory}
+    resolution: {directory: vendor/CultLib/packages/cultcache-ts, type: directory}
     engines: {node: '>=18'}
 
-  cultmesh-ts@file:../CultLib/packages/cultmesh-ts:
+  cultmesh-ts@file:vendor/CultLib/packages/cultmesh-ts:
-    resolution: {directory: ../CultLib/packages/cultmesh-ts, type: directory}
+    resolution: {directory: vendor/CultLib/packages/cultmesh-ts, type: directory}
     engines: {node: '>=18'}
 
-  cultnet-ts@file:../CultLib/packages/cultnet-ts:
+  cultnet-ts@file:vendor/CultLib/packages/cultnet-ts:
-    resolution: {directory: ../CultLib/packages/cultnet-ts, type: directory}
+    resolution: {directory: vendor/CultLib/packages/cultnet-ts, type: directory}
     engines: {node: '>=18'}
 
   define-data-property@1.1.4:
@@ -1379,22 +1379,22 @@ snapshots:
 
   cookie@1.1.1: {}
 
-  cultcache-ts@file:../CultLib/packages/cultcache-ts:
+  cultcache-ts@file:vendor/CultLib/packages/cultcache-ts:
     dependencies:
       '@msgpack/msgpack': 3.1.3
       zod: 3.25.76
 
-  cultmesh-ts@file:../CultLib/packages/cultmesh-ts:
+  cultmesh-ts@file:vendor/CultLib/packages/cultmesh-ts:
     dependencies:
       '@msgpack/msgpack': 3.1.3
-      cultcache-ts: file:../CultLib/packages/cultcache-ts
+      cultcache-ts: file:vendor/CultLib/packages/cultcache-ts
-      cultnet-ts: file:../CultLib/packages/cultnet-ts
+      cultnet-ts: file:vendor/CultLib/packages/cultnet-ts
 
-  cultnet-ts@file:../CultLib/packages/cultnet-ts:
+  cultnet-ts@file:vendor/CultLib/packages/cultnet-ts:
     dependencies:
       '@msgpack/msgpack': 3.1.3
       ajv: 8.20.0
-      cultcache-ts: file:../CultLib/packages/cultcache-ts
+      cultcache-ts: file:vendor/CultLib/packages/cultcache-ts
 
   define-data-property@1.1.4:
     dependencies:

vendor/CultLib

@@ -0,0 +1 @@
+Subproject commit 5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9